As software development speeds up and AI agents become embedded in business applications, traditional penetration testing is struggling to keep pace. Annual assessments provide snapshots of security posture, but vulnerabilities can emerge and remain undetected in the long periods between testing cycles.
For Simpson Strong-Tie, a leading manufacturer of construction fasteners, the challenge was particularly significant. The company maintains approximately 60 to 65 customer-facing and internal software products, many supporting its manufacturing operations.
During a recent SC Media webcast moderated by Application Security Weekly host Mike Shema, Simpson Strong-Tie Cybersecurity Manager Abhi Patkar explained how the company adopted Novee Security's AI-driven penetration-testing platform to continuously validate application security. Novee Security Co-founder and CEO Ido Geffen also participated in the conversation.
Moving beyond annual penetration tests
Previously, Simpson Strong-Tie conducted annual penetration tests primarily to satisfy audit requirements. The process was cumbersome and required extensive preparation, repeated explanations of application functionality, and considerable developer involvement.
The findings from these earlier pen-tests often revealed familiar vulnerabilities, such as SQL injection and cross-site scripting. More complex weaknesses remained difficult to uncover.
Meanwhile, continuous integration and delivery pipelines were accelerating Simpson Strong-Tie's software releases, making point-in-time assessments increasingly inadequate.
"Software is getting built at light speed," Patkar observed, describing how automation, machine learning and AI agents are transforming development.
Novee's platform offered an alternative. It integrated automated testing into development workflows, with assessments repeated as applications changed.
Finding vulnerabilities that conventional testing misses
Novee uses offensive AI agents to explore applications, understand business workflows and develop attack paths that resemble real adversary behavior.
According to Geffen, the platform builds an asset-intelligence model that maps application functionality, user roles, access permissions and potential exploitation opportunities.
For Simpson Strong-Tie, this approach uncovered vulnerabilities extending beyond conventional scanning results. Patkar described instances in which the platform identified session-management weaknesses and privilege-escalation opportunities, including administrative permissions that persisted after users switched to lower-privileged roles.
"It's not that easy to find things at that granular level," Patkar said.
The platform also generates threat models and provides developers with evidence showing how vulnerabilities can be reproduced. Feedback about acceptable business behavior helps refine subsequent assessments, reducing irrelevant findings. Continuous testing allows teams to verify fixes and identify newly introduced weaknesses without waiting for another annual assessment.
Safely deploying offensive AI in production
However, letting autonomous agents conduct offensive security testing against production systems introduces its own risks.
Patkar recommended a phased approach: Begin in development and quality-assurance environments, establish confidence in the platform, then gradually introduce production testing against less critical applications.
Novee supplements this operational discipline with multiple protective layers. Geffen described behavioral instructions that guide agents away from harmful actions, deterministic controls that restrict endpoints and network destinations, and monitoring that can stop tests when latency or error thresholds are exceeded.
"We understand that it's not enough, so we have two more layers," Geffen said. "The second one is hard guardrails, which are deterministic ones."
An independent AI-based validator also evaluates proposed agent actions. Logging, investigation procedures and testing in Novee's internal laboratory help prevent previously encountered problems from recurring.
Continuous assurance with fewer operational demands
The transition has also reduced administrative overhead. Patkar said Simpson Strong-Tie's initial proof of concept took three days, while continuous testing has freed time previously spent coordinating conventional assessments.
"I'm able to free my time and focus on critical aspects of the business and upcoming things," he said.
For organizations deploying AI-powered applications, Simpson Strong-Tie's experience demonstrates that continuous security validation can uncover deeper vulnerabilities while reducing repetitive work.
The essential combination is attacker-level testing, business-context awareness and carefully governed automation. Together, these capabilities can help security teams keep pace with development without sacrificing production stability.
